PowerShell Basics: How to Force a Full Password Sync in AzureAD Connect

Published Oct 10 2019 12:01 AM 20K Views
Microsoft

Before starting this post, the team would like to thank all the contributions shared by the PowerShell community found on Reddit for their support on exploring PowerShell automation capabilities.  The outpouring of suggestions and sharing of scripts was awesome and has resulted in another question asked for us as a community to address.

 

After reading the previous PowerShell Basics article, some from the ITPRO community have reached out inquiring how to force the sync of only passwords and not the entire contents of Active Directory.  It appears the ask comes in light of troubleshooting Office 365 password sync issues.  This post will focus on steps to address this via PowerShell.
 
Lets begin.

 

  1. Run PowerShell
     
    Run PowerShell Force AzureAD Password SyncRun PowerShell Force AzureAD Password Sync
     
  2. Assign the local Active Directory $adConnector value and remember it is case sensitive: 
     
    $adConnector = "<insert local connector name here>"
  3. Assign the AzureAD $aadConnector value and remember it is case sensitive: 
     
    $aadConnector = "<insert AzureAD connector name here>"
     
  4. Install the AzureAD Sync module:
     
    Import-Module ADSync

     

  5. Create a new ForceFullPasswordSync configuration parameter object
     
    $c = Get-ADSyncConnector -Name $adConnector
     
  6. Update the existing connector with the following new configuration. Remember to enter each line separately: 
     
    $p = New-Object Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter "Microsoft.Synchronize.ForceFullPasswordSync", String, ConnectorGlobal, $null, $null, $null
    $p.Value = 1
    $c.GlobalParameters.Remove($p.Name)
    $c.GlobalParameters.Add($p)
    $c = Add-ADSyncConnector -Connector $c
     
  7. Disable Azure AD Connect:
    Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $azureadConnector -Enable $false
     
  8. Re-enable Azure AD Connect to force a full password synchronization:
    Set-ADSyncAADPasswordSyncConfiguration -SourceConnector $adConnector -TargetConnector $azureadConnector -Enable $true

Synchronization of legacy password hashes to Azure AD may take some time and depend on directory size in terms of number of accounts and groups. Once completed, the passwords are synchronized to the to Azure AD followed by syncing to the Azure AD DS managed domain.

 

Microsoft also provides a great document entitled Troubleshoot password hash synchronization with Azure AD Connect sync which details additional tactics to address possible sync issues.

 

10 Comments
%3CLINGO-SUB%20id%3D%22lingo-sub-999309%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-999309%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20can%20i%20sync%20a%20password%20for%20single%20user%20only%3F%3C%2FP%3E%3CP%3Ei%20can%20do%20it%20in%20the%20troubleshoot%20tool%20in%20AAd%20connect.%20but%20i%20cant%20find%20the%20PS%20commands%20to%20do%20it%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20problem%20when%20we%20create%20new%20users%2C%20that%20are%20disabled..%3C%2FP%3E%3CP%3E1.%20New%20user%20%3D%20disabled%20in%20AD%3C%2FP%3E%3CP%3E2.%20user%20synced%20to%20Azure%20AD%20by%20aad%20connect.%3C%2FP%3E%3CP%3E3.%20Flag%20%22user%20must%20change%20password%20next%20logon%22%20is%20set.%20(%20here%20i%20hoped%20the%20Password%20would%20allready%20be%20synced%2C%20but%20apparently%20not)%26nbsp%3B%3C%2FP%3E%3CP%3E4.%20then%20i%20enable%20user%3C%2FP%3E%3CP%3E5.%20Sync%20again%20to%20AAAD%3C%2FP%3E%3CP%3E6.%20User%20unable%20to%20sign%20in%20(%20no%20password%20hash%20are%20synced)%3C%2FP%3E%3CP%3E7.%20i%20try%20removing%26nbsp%3B%26nbsp%3BFlag%20%22user%20must%20change%20password%20next%20logon%22%2C%20and%20wait%20a%20litle%3C%2FP%3E%3CP%3E8.%20user%20still%20not%20able%20to%20sign-in%20(%20no%20password%20are%20synced)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20then%20found%20out%20int%20he%20metaverse%20object%20log%2C%20it%20says%3A%20passwordsync%3A%20filteredByTarget.%3CBR%20%2F%3Edocu%20says%20it%20is%20because%20must%20change%20pw%20flag%20is%20set.%20BUT%20IT%20IS%20NOT%3C%2FP%3E%3CP%3Eand%20User%20account%20controll%20says%20512%20%3D%20enabled%20%2C%20and%20pwdLastSet%20are%20a%20date%2C%20and%20not%20%220%22.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20i%20thinks%20this%20is%20a%20bug.%20But%20any%20how%2C%20i%20want%20to%20manualy%20sync%20this%20users%20PH%20to%20AAD.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOnly%20when%20i%20reset%20the%20users%20password%20it%20gets%20synced%20again%2C%20with%20no%20other%20modifications%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-999526%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-999526%22%20slang%3D%22en-US%22%3E%3CP%3EI%20found%20an%20answer%20to%20my%20own%20question%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3EAn%20undocumented%20command%20in%20the%20aadconnect%20module%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EInvoke-ADSyncCSObjectPasswordHashSync%20-ConnectorName%20Domain.com%20-DistinguishedName%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20will%20sync%20password%20hash%20of%20a%20single%20user%20object%20to%20AAD.%3CBR%20%2F%3EIf%20it%20fails%2C%20it%20is%20because%20the%20flag%20%22user%20must%20change%20password%20at%20next%20logon%22%20is%20set%2C%20re%20move%20it%20and%20you%20can%20sync%20instantly.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1001723%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1001723%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F151618%22%20target%3D%22_blank%22%3E%40Micki%20Wulffeld%3C%2FA%3E%26nbsp%3BThis%20is%20now%20supported.%3C%2FP%3E%0A%3CH4%20id%3D%22public-preview-of-synchronizing-temporary-passwords-and-force-password-on-next-logon%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%20id%3D%22toc-hId-1452084216%22%3EPublic%20Preview%20of%20synchronizing%20temporary%20passwords%20and%20%22Force%20Password%20on%20Next%20Logon%3C%2FH4%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Fhow-to-connect-password-hash-synchronization%23public-preview-of-synchronizing-temporary-passwords-and-force-password-on-next-logon%26nbsp%3B%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Fhow-to-connect-password-hash-synchronization%23public-preview-of-synchronizing-temporary-passwords-and-force-password-on-next-logon%26nbsp%3B%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1001733%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1001733%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-Microsoft%20lia-component-message-view-widget-author-username%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F53240%22%20target%3D%22_self%22%3E%3CSPAN%20class%3D%22%22%3EJithesh%20Raj%20(JR)%3C%2FSPAN%3E%3C%2FA%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3CP%3E%3CSPAN%3EThanks%2C%20and%20i%20have%20seen%20it%20but%20it%20is%20in%20preview%20%2F%20beta%20(%20not%20for%20production%20enviroment).%20So%20we%20are%20waiting%20for%20the%20GA.%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EDo%20you%20know%20any%20ETA%20on%20GA%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1001739%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1001739%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F151618%22%20target%3D%22_blank%22%3E%40Micki%20Wulffeld%3C%2FA%3E%26nbsp%3BPublic%20Preview%20is%20fully%20supported%20and%20can%20be%20implemented%20for%20production%20and%20cannot%20be%20compared%20to%20the%20traditional%20beta%20programs%20which%20are%20not%20released%20for%20production%20use.%20But%20if%20there%20is%20a%20business%20restriction%20in%20taking%20up%20something%20in%20public%20preview%2C%20we%20completely%20understand.%20Most%20of%20our%20public%20preview's%20go%20into%26nbsp%3B%20GA%20within%2012%20months%20of%20public%20preview.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1001760%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1001760%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F53240%22%20target%3D%22_self%22%3E%3CSPAN%20class%3D%22%22%3EJithesh%20Raj%20(JR)%3C%2FSPAN%3E%3C%2FA%3E%3C%2FP%3E%3CP%3EGenerally%20we%20dont%20implement%20preview%20features%20i%20production%2C%20because%20many%20of%20them%20are%20(understanderbly)%20not%20fully%20ready.%3C%2FP%3E%3CP%3ETake%20for%20example%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Fhow-to-connect-staged-rollout%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Fhow-to-connect-staged-rollout%3C%2FA%3E%3CBR%20%2F%3EThere%20are%20some%20unsupported%20senarios%2C%20and%20athat%20is%20fully%20understandable.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20personally%20thinks%20it%20is%20a%20good%20strategy%20to%20develop%20%2F%20release%20fast%20with%20the%20preview%20feature.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20also%20found%20this%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpower-platform%2Fadmin%2Fwhat-are-preview-features-how-do-i-enable-them%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpower-platform%2Fadmin%2Fwhat-are-preview-features-how-do-i-enable-them%3C%2FA%3E%3C%2FP%3E%3CP%3EI%20know%20i%20does%20not%20relate%20directly%20to%20all%20preview%20features%2C%20but%20above%20link%20is%20my%20understanding%20of%20public%20preview.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20maybe%20you%20can%20put%20is%20this%20way%2C%20Private%20preview%20is%20Beta%2C%20Public%20preview%20is%20RC%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1001785%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1001785%22%20slang%3D%22en-US%22%3E%3CP%3EThat%20last%20part%20is%20about%20right.%20But%20I%20am%20a%20little%20surprised%20that%20you%20are%20open%20to%20use%20a%20cmdlet%20you%20mentioned%20above%20which%20is%20not%20documented%20(not%20supported)%20but%20hesitant%20to%20use%20public%20preview%20that%20the%20product%20group%20is%20saying%20can%20be%20used%20in%20production.%20Public%20previews%20have%20a%20few%20caveats%20and%20when%20we%20say%20somethings%20are%20not%20supported%2C%20it%20might%20stay%20that%20way%20even%20when%20we%20go%20GA%20due%20to%20the%20fact%20that%20the%20feature%20was%20not%20built%20to%20support%20those%20methods.%20You%20will%20find%20unsupported%20methods%20in%20features%20which%20are%20in%20GA%20as%20well%20so%20that%20may%20not%20be%20a%20great%20example%20to%20define%20public%20previews.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1002024%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1002024%22%20slang%3D%22en-US%22%3E%3CP%3EI%20think%20the%20key%20word%20here%20is%20%22Product%20Group%22.%3C%2FP%3E%3CP%3EI%20accept%20when%20you%20say%26nbsp%3BPublic%20Preview%20of%20synchronizing%20temporary%20passwords%20and%20%22Force%20Password%20on%20Next%20Logon%20is%20Supported.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20generally%20you%20can%20not%20say%20that%2C%20and%20therefore%20i%20can%20not%20answer%20to%20my%20organisation%20by%20implementing%20preview%20features%20in%20production.%3CBR%20%2F%3EI%20have%20for%20example%20experienced%20preview%20of%20outlook%20online%2C%20did%20not%20comply%20with%20GAL%20segmentation%2C%20and%20therefore%20did%20not%20comply%20with%20company%20policy.%3CBR%20%2F%3EAnd%20that%20might%20had%20been%20a%20bug%20%2F%20not%20yet%20developed.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1006197%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1006197%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F151618%22%20target%3D%22_blank%22%3E%40Micki%20Wulffeld%3C%2FA%3E%26nbsp%3BI%20agree%20with%20you.%20It%20is%20important%20to%20know%20if%20the%20previews%20are%20signed%20off%20for%20production%20use%20or%20not.%20In%20some%20cases%20we%20also%20explicitly%20call%20this%20out%20in%20our%20docs%20as%20well.%20If%20you%20need%20any%20support%20on%20the%20Staged%20Rollout%20feature%2C%20please%20let%20me%20know.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2113977%22%20slang%3D%22en-US%22%3ERe%3A%20PowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2113977%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20is%20a%20typo%20in%20step3%20(or%20in%20step%207%20%26amp%3B%208)%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%24%3CSTRONG%3Eaad%3C%2FSTRONG%3EConnector%20%3D%20%22%3CINSERT%20azuread%3D%22%22%20connector%3D%22%22%20name%3D%22%22%20here%3D%22%22%3E%22%3C%2FINSERT%3E%3C%2FP%3E%3CP%3Eshould%20be%3A%3CBR%20%2F%3E%24%3CSTRONG%3Eazuread%3C%2FSTRONG%3EConnector%20%3D%20%22%3CINSERT%20azuread%3D%22%22%20connector%3D%22%22%20name%3D%22%22%20here%3D%22%22%3E%22%3C%2FINSERT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-900063%22%20slang%3D%22en-US%22%3EPowerShell%20Basics%3A%20How%20to%20Force%20a%20Full%20Password%20Sync%20in%20AzureAD%20Connect%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-900063%22%20slang%3D%22en-US%22%3E%3CP%3EBefore%20starting%20this%20post%2C%20the%20team%20would%20like%20to%20thank%20all%20the%20contributions%20shared%20by%20the%20%3CA%20title%3D%22PowerShell%20community%20found%20on%20Reddit%22%20href%3D%22https%3A%2F%2Fwww.reddit.com%2Fr%2FPowerShell%2Fcomments%2Fdcp39f%2Fhow_to_force_azuread_connect_to_sync_via%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3EPowerShell%20community%20found%20on%20Reddit%3C%2FA%3E%20for%20their%20support%20on%20exploring%20PowerShell%20automation%20capabilities.%26nbsp%3B%20The%20outpouring%20of%20suggestions%20and%20sharing%20of%20scripts%20was%20awesome%20and%20has%20resulted%20in%20another%20question%20asked%20for%20us%20as%20a%20community%20to%20address.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAfter%20reading%20the%20previous%20%3CA%20title%3D%22PowerShell%20Basics%3A%20How%20to%20Force%20AzureAD%20Connect%20to%20Sync%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FITOps-Talk-Blog%2FPowerShell-Basics-How-to-Force-AzureAD-Connect-to-Sync%2Fba-p%2F887043%3FWT.mc_id%3DITOPSTALK-blog-abartolo%22%20target%3D%22_blank%22%3EPowerShell%20Basics%20article%3C%2FA%3E%2C%20some%20from%20the%20ITPRO%20community%20have%20reached%20out%20inquiring%20how%20to%20force%20the%20sync%20of%20only%20passwords%20and%20not%20the%20entire%20contents%20of%20Active%20Directory.%26nbsp%3B%20It%20appears%20the%20ask%20comes%20in%20light%20of%20troubleshooting%20Office%20365%20password%20sync%20issues.%26nbsp%3B%20This%20post%20will%20focus%20on%20steps%20to%20address%20this%20via%20PowerShell.%20%3CBR%20%2F%3E%26nbsp%3B%3CBR%20%2F%3ELets%20begin.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3ERun%20PowerShell%3CBR%20%2F%3E%26nbsp%3B%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22How_to_Force_a_Full_Password_Sync_in_AzureAD_Connect_001.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F135894iDF470B1FB4242B46%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22How_to_Force_a_Full_Password_Sync_in_AzureAD_Connect_001.png%22%20alt%3D%22Run%20PowerShell%20Force%20AzureAD%20Password%20Sync%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3ERun%20PowerShell%20Force%20AzureAD%20Password%20Sync%3C%2FSPAN%3E%3C%2FSPAN%3E%3CBR%20%2F%3E%26nbsp%3B%3C%2FLI%3E%0A%3CLI%3EAssign%20the%20local%20Active%20Directory%26nbsp%3B%3CSTRONG%3E%24adConnector%26nbsp%3B%3C%2FSTRONG%3Evalue%20and%20remember%20it%20is%20case%20sensitive%3A%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%3CPRE%3E%24adConnector%20%3D%20%22%26lt%3Binsert%20local%20connector%20name%20here%26gt%3B%22%3C%2FPRE%3E%0A%3CCODE%3E%3C%2FCODE%3E%3C%2FLI%3E%0A%3CLI%3EAssign%20the%20AzureAD%26nbsp%3B%3CSTRONG%3E%24aadConnector%26nbsp%3B%3C%2FSTRONG%3Evalue%20and%20remember%20it%20is%20case%20sensitive%3A%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%0A%3CPRE%3E%24aadConnector%20%3D%20%22%26lt%3Binsert%20AzureAD%20connector%20name%20here%26gt%3B%22%3C%2FPRE%3E%0A%26nbsp%3B%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EInstall%20the%20AzureAD%20Sync%20module%3A%3C%2FSPAN%3E%3CBR%20%2F%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%0A%3CPRE%3EImport-Module%20ADSync%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FLI%3E%0A%3CLI%3E%20%3CSPAN%3ECreate%20a%20new%20ForceFullPasswordSync%20configuration%20parameter%20object%3C%2FSPAN%3E%3A%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%0A%3CPRE%3E%24c%20%3D%20Get-ADSyncConnector%20-Name%20%24adConnector%3C%2FPRE%3E%0A%26nbsp%3B%3C%2FLI%3E%0A%3CLI%3EUpdate%20the%20existing%20connector%20with%20the%20following%20new%20configuration.%20Remember%20to%20enter%20each%20line%20separately%3A%26nbsp%3B%3CBR%20%2F%3E%26nbsp%3B%0A%3CPRE%3E%24p%20%3D%20New-Object%20Microsoft.IdentityManagement.PowerShell.ObjectModel.ConfigurationParameter%20%22Microsoft.Synchronize.ForceFullPasswordSync%22%2C%20String%2C%20ConnectorGlobal%2C%20%24null%2C%20%24null%2C%20%24null%0A%24p.Value%20%3D%201%3C%2FPRE%3E%0A%3CPRE%3E%24c.GlobalParameters.Remove(%24p.Name)%3C%2FPRE%3E%0A%3CPRE%3E%24c.GlobalParameters.Add(%24p)%3C%2FPRE%3E%0A%3CPRE%3E%24c%20%3D%20Add-ADSyncConnector%20-Connector%20%24c%3C%2FPRE%3E%0A%26nbsp%3B%3C%2FLI%3E%0A%3CLI%3EDisable%20Azure%20AD%20Connect%3A%3CBR%20%2F%3E%0A%3CPRE%3ESet-ADSyncAADPasswordSyncConfiguration%20-SourceConnector%20%24adConnector%20-TargetConnector%20%24azureadConnector%20-Enable%20%24false%3C%2FPRE%3E%0A%26nbsp%3B%3C%2FLI%3E%0A%3CLI%3ERe-enable%20Azure%20AD%20Connect%20to%20force%20a%20full%20password%20synchronization%3A%3CBR%20%2F%3E%0A%3CPRE%3ESet-ADSyncAADPasswordSyncConfiguration%20-SourceConnector%20%24adConnector%20-TargetConnector%20%24azureadConnector%20-Enable%20%24true%3C%2FPRE%3E%0A%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%3CSPAN%3ESynchronization%20of%20legacy%20password%20hashes%20to%20Azure%20AD%20may%20take%20some%20time%20and%20depend%20on%20directory%20size%20in%20terms%20of%20number%20of%20accounts%20and%20groups.%20Once%20completed%2C%20the%20passwords%20are%20synchronized%20to%20the%20to%20Azure%20AD%20followed%20by%20syncing%20to%20the%20Azure%20AD%20DS%20managed%20domain.%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EMicrosoft%20also%20provides%20a%20great%20document%20entitled%20%3CSTRONG%3E%3CA%20title%3D%22Troubleshoot%20password%20hash%20synchronization%26nbsp%3Bwith%20Azure%20AD%20Connect%20sync%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fhybrid%2Ftshoot-connect-password-hash-synchronization%3FWT.mc_id%3DITOPSTALK-blog-abartolo%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ETroubleshoot%20password%20hash%20synchronization%26nbsp%3Bwith%20Azure%20AD%20Connect%20sync%3C%2FA%3E%3C%2FSTRONG%3E%20which%20details%20additional%20tactics%20to%20address%20possible%20sync%20issues.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%3E%3CIFRAME%20src%3D%22https%3A%2F%2Fchannel9.msdn.com%2FSeries%2FAzure-Active-Directory-Videos-Demos%2FAzure-AD-Connect-Updates-Pass-through-authentication%2Fplayer%3FWT.mc_id%3Dmodinfra-0000-abartolo%22%20width%3D%22640%22%20height%3D%22360%22%20frameborder%3D%220%22%20allowfullscreen%3D%22allowfullscreen%22%20title%3D%22Azure%20AD%20Connect%20Updates%3A%20Pass-through%20authentication%20-%20Microsoft%20Channel%209%20Video%22%3E%3C%2FIFRAME%3E%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-900063%22%20slang%3D%22en-US%22%3E%3CP%3EAfter%20reading%20the%20previous%20%3CA%20title%3D%22PowerShell%20Basics%3A%20How%20to%20Force%20AzureAD%20Connect%20to%20Sync%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FITOps-Talk-Blog%2FPowerShell-Basics-How-to-Force-AzureAD-Connect-to-Sync%2Fba-p%2F887043%3FWT.mc_id%3DITOPSTALK-blog-abartolo%22%20target%3D%22_blank%22%3EPowerShell%20Basics%20article%3C%2FA%3E%2C%20some%20from%20the%20ITPRO%20community%20have%20reached%20out%20inquiring%20how%20to%20force%20the%20sync%20of%20only%20passwords%20and%20not%20the%20entire%20contents%20of%20Active%20Directory.%26nbsp%3B%20It%20appears%20the%20ask%20comes%20in%20light%20of%20troubleshooting%20Office%20365%20password%20sync%20issues.%26nbsp%3B%20This%20post%20will%20focus%20on%20steps%20to%20address%20this%20via%20PowerShell.%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22PowerShell_Basics.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F134944iD72B3B0B8F4E0886%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22PowerShell_Basics.jpg%22%20alt%3D%22PowerShell%20Basics%3A%20How%20to%20Delete%20Microsoft%20Teams%20Cache%20for%20All%20Users%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EPowerShell%20Basics%3A%20How%20to%20Delete%20Microsoft%20Teams%20Cache%20for%20All%20Users%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-900063%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAnthony%20Bartolo%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPowerShell%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Co-Authors
Version history
Last update:
‎May 04 2021 07:21 AM
Updated by: